Sigma detection rules, expert-reviewed

Suspicious Kubernetes SelfSubjectAccessReview Permission Enumeration

This rule detects creation of SelfSubjectAccessReview or SelfSubjectRulesReview objects which are used to enumerate the permissions granted to the current identity as described in NCC Group Kubernetes detection engineering research. Adversaries query their own effective RBAC access to plan privilege escalation and lateral movement so bursts of these reviews should be investigated.

Suspicious Privileged or Host Namespace Kubernetes Pod Creation

This rule detects creation of Kubernetes pods that request privileged containers or share the host PID IPC or network namespaces as described in NCC Group Kubernetes detection engineering research. Adversaries deploy such pods to break container isolation and gain access to the underlying node which is a common container escape and persistence technique.

Malicious Kubernetes Reconnaissance Tooling Activity

This rule detects Kubernetes reconnaissance and attack tooling either via the Rakkess access matrix user agent or the deployment of known offensive container images such as kubiscan kube-hunter and kubestriker as described in NCC Group Kubernetes detection engineering research. Adversaries run these tools to map RBAC permissions and hunt for cluster misconfigurations before privilege escalation.

Malicious Privileged Container Creation in Kubernetes (via audit)

This rule detects a Kubernetes API request that creates a pod with a privileged security context, which grants the container near-host capabilities and is a primary path for escaping to the underlying node. Container escape and privileged workloads are emerging techniques in the Red Canary Threat Detection Report as adversaries target cloud-native environments. Detecting privileged pod creation surfaces a high-risk configuration that enables host compromise.

Malicious Cluster-Admin Role Binding Creation (via audit)

This rule detects creation of a ClusterRoleBinding or RoleBinding, which can grant an attacker cluster-admin privileges over a Kubernetes cluster, a privilege-escalation and persistence technique in cloud-native environments. Abusive role binding is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these requests surfaces an attempt to entrench elevated access.

Suspicious Command Execution Inside a Kubernetes Pod (via audit)

This rule detects a create request against the pods/exec subresource, which opens an interactive shell inside a running container, a technique attackers use for hands-on-keyboard access to a Kubernetes workload. Exec into pod is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these requests surfaces interactive access to container workloads.

Suspicious Kubernetes API Request From Anonymous User

This rule detects Kubernetes API server requests authenticated as the anonymous or unauthenticated system identity which indicates an unauthenticated actor probing the cluster control plane as described in NCC Group Kubernetes detection engineering research. Adversaries leverage anonymous access to enumerate resources and stage container escapes so any such request warrants investigation.

Suspicious Anonymous Access to Kubernetes API Server via Audit Log

This rule detects Kubernetes API server requests authenticated as system:anonymous or belonging to the system:unauthenticated group. Adversaries query an unauthenticated API server to enumerate pods, secrets, and other cluster resources for reconnaissance and initial access. Anonymous access to the control plane indicates a misconfigured cluster exposed to untrusted callers.

Suspicious Shell Execution Into Kubernetes Pod via API

This rule detects Kubernetes API exec subresource requests whose request URI invokes an interactive shell such as bin bash or bin sh inside a running pod as described in NCC Group Kubernetes detection engineering research. Adversaries abuse pod exec to gain interactive access to containers for reconnaissance and lateral movement so unexpected shell sessions should be reviewed.